Threat behavior detection and model establishment method, device, electronic device and storage medium

Abstract

The present application provides a method, device, electronic device and storage medium for threat behavior detection and model establishment, and relates to the technical field of network security. The method for establishing a threat behavior detection model includes: creating a training set and a verification set based on the attribute features and behavior features in the user data set; calling the LGBMClassifier interface to instantiate the model, and setting the model parameters of the instantiated model through the interface; The interface instantiation model is trained to obtain a threat behavior detection model based on LightGBM. The detection model is used to output the illegal probability based on the input detection features. The detection features include the attribute features and behavior features of the user to be detected. Threat behavior detection through the threat behavior detection model does not need to set a separate detection model for each user, and the LightGBM algorithm has the characteristics of parallel computing, which improves the detection efficiency and reduces its consumption of computing resources.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular, to a method, apparatus, electronic device and storage medium for threat behavior detection and model establishment. Background technique [0002] Insider threats refer to insiders or external attackers disguised as insiders who use legal identities and permissions to destroy systems or data, steal information, abuse resources, etc., posing security hazards to enterprises or organizations. With the gradual strengthening of security protection technologies such as firewalls, insider threats have gradually become a common method for attackers to implement insider threats through password theft and profit inducement. [0003] Insider threat detection is usually based on user log data in the internal network. In related research, machine learning algorithms such as K-Means, Isolation Forest, Long Short-Term Memory Network, and Bayesian Network are widely used to d...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the purpose of the embodiments of the present application is to provide a threat behavior detection and model building method, device, electronic equipment, and storage medium to improve the low efficiency of internal threat behavior detection and occupy many computing resources in the prior art.

Images